Application code scanners, which analyse source, binary or byte code for security flaws, malicious code and back doors, must be used whenever possible and particularly in development so flagged code is remediated before release, with mitigations such as IDS or network access restrictions where remediation is impossible; application vulnerability scanners that test a running application for SQL injection, code injection, cross-site scripting, file disclosure, permission and configuration weaknesses must be used regularly, after product updates or major reconfigurations and before activating a new application in production; and mobile code, code downloaded and executed without the user's explicit initiation, is governed by DOD category: Category 1A technologies (ActiveX, WSH scripts, the Internet Explorer ActiveX runtime with usage restrictions) may run only signed code, Category 1X technologies (HTML applications, scrap objects, MS-DOS batch and Unix shell scripts, binary executables, Shockwave movies and the named ActiveX plugin runtimes downloaded as mobile code) are prohibited, Category 2 (Java applets, VBA, LotusScript, PerfectScript, PostScript, .NET CLR mobile code, PDF, Flash, rich internet applications) is moderate risk under controlled access, and Category 3 supports limited functionality and may execute in the browser.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.